Buggy code:
public class TinySecurityInterceptor extends HandlerInterceptorAdapter { private static final Logger log = LoggerFactory . getLogger ( TinySecurityInterceptor . class ) ; private String accessDeniedUrl ; private String privilegeDeniedUrl ; TinyAuthenticator authenticator ; public TinyAuthenticator getAuthenticator ( ) { } public void setAuthenticator ( TinyAuthenticator authenticator ) { } @ Override public boolean preHandle ( HttpServletRequest request , HttpServletResponse response , Object handler ) throws Exception { if ( handler instanceof ResourceHttpRequestHandler ) { return true ; } if ( handler instanceof HandlerMethod ) { HandlerMethod handlerMethod = ( ( HandlerMethod ) ( handler ) ) ; SecurityCheck classAnnotation = handlerMethod . getMethod ( ) . getDeclaringClass ( ) . getAnnotation ( SecurityCheck . class ) ; SecurityCheck methodAnnotation = handlerMethod . getMethodAnnotation ( SecurityCheck . class ) ; String entry = request . getRequestURI ( ) . replace ( request . getContextPath ( ) , "" ) ; if ( methodAnnotation != null ) { if ( ! ( methodAnnotation . value ( ) ) ) { TinySecurityInterceptor . log . debug ( "Security<seq2seq4repair_space>Check<seq2seq4repair_space>for<seq2seq4repair_space>[{}]<seq2seq4repair_space>disabled.<seq2seq4repair_space>Access<seq2seq4repair_space>granted." , entry ) ; } else { <START_BUG> checkAndRespond ( entry , request , response , methodAnnotation ) ; <END_BUG> } } else { if ( classAnnotation == null ) { TinySecurityInterceptor . log . debug ( "No<seq2seq4repair_space>@SecurityCheck<seq2seq4repair_space>found<seq2seq4repair_space>for<seq2seq4repair_space>[{}].<seq2seq4repair_space>Access<seq2seq4repair_space>granted." , entry ) ; } else { String [ ] matches = classAnnotation . matches ( ) ; String [ ] excludes = classAnnotation . excludes ( ) ; boolean requireCheck = false ; for ( String match : matches ) { if ( match . contains ( "**" ) ) { match = match . replace ( "**" , ".*" ) ; } else { match = match . replace ( "*" , "[^//]*" ) ; } if ( entry . matches ( match ) ) { requireCheck = true ; } else { TinySecurityInterceptor . log . debug ( "SecurityCheck<seq2seq4repair_space>for<seq2seq4repair_space>[{}]<seq2seq4repair_space>not<seq2seq4repair_space>matched.<seq2seq4repair_space>Access<seq2seq4repair_space>granted." , entry ) ; } if ( requireCheck ) { for ( String exclude : excludes ) { if ( exclude . contains ( "**" ) ) { exclude = exclude . replace ( "**" , ".*" ) ; } else { exclude = exclude . replace ( "*" , "[^//]*" ) ; } exclude = ( ".*" + exclude ) + ".*" ; if ( entry . matches ( exclude ) ) { requireCheck = false ; TinySecurityInterceptor . log . debug ( "SecurityCheck<seq2seq4repair_space>for<seq2seq4repair_space>[{}]<seq2seq4repair_space>excluded.<seq2seq4repair_space>Access<seq2seq4repair_space>granted." , entry ) ; break ; } } } } if ( requireCheck ) { return checkAndRespond ( entry , request , response , classAnnotation ) ; } } } } return true ; } private boolean checkAndRespond ( String entry , HttpServletRequest request , HttpServletResponse response , SecurityCheck annotation ) throws IOException , ServletException { } @ Override public void postHandle ( HttpServletRequest request , HttpServletResponse response , Object handler , ModelAndView modelAndView ) throws Exception { } @ Override public void afterCompletion ( HttpServletRequest request , HttpServletResponse response , Object handler , Exception ex ) throws Exception { } public String getAccessDeniedUrl ( ) { } public void setAccessDeniedUrl ( String accessDeniedUrl ) { } public String getPrivilegeDeniedUrl ( ) { } public void setPrivilegeDeniedUrl ( String privilegeDeniedUrl ) { } }

Fix:
return checkAndRespond ( entry , request , response , methodAnnotation ) ;